fix(lambda): close the remaining contract validation gaps (#7241)

* fix(lambda): close the remaining contract validation gaps

Follow-up to #7216, from review on the release PR. Every bound added here is
one the AWS Lambda API reference documents; findings that asked for undocumented
limits were left alone.

Code source selection had two holes. `hasS3` required both S3 fields, so a
partial pair alongside `imageUri` read as "image only" and the stray S3 field
still went to AWS; and an `imageUri` with no `packageType` was accepted even
though the package type then defaults to Zip. Both now fail at the boundary,
naming the field to change, and the zip-only `s3ObjectVersion` and
`sourceKmsKeyArn` count as S3 fields for the exclusivity check.

The VPC guard only checked that both lists were supplied, so supplying both
with one empty passed and produced a partial update. Both must now be empty
(detach) or both populated (attach).

Documented bounds added:

- alias names: 1-128 and the documented pattern, which excludes all-digit names
- descriptions: 256 characters
- layer names: 140 characters and the name-or-ARN pattern
- optional `functionName` on the event source mapping operations: 1-256
- `RemovePermission` statement IDs: 1-100 and its own pattern, which allows a
  dot where `AddPermission` does not

Also rejects values that are structurally meaningless rather than merely
out of range: empty tag keys, empty Kafka bootstrap servers, more than one
weighted routing entry, and an event source mapping that supplies both an
event source ARN and self-managed Kafka bootstrap servers.

* fix(lambda): match twelve digits in the layer ARN pattern

The account-ID segment was written as `\d{12}` inside a template literal, so the
emitted regex carried a literal `d{12}` and rejected every real layer ARN. The
existing test only covered an over-long name, which is why it passed.

Escapes the backslash and adds the coverage that would have caught it: a real
layer ARN and a bare layer name are both accepted, and an ARN whose account
segment is not twelve digits is rejected.

* fix(lambda): reject empty code-source fields instead of ignoring them

The mutual-exclusivity check used truthiness, so `imageUri` alongside
`s3Bucket: ''` read as image-only while the create operation still forwarded the
defined empty field to AWS.

An empty string is meaningless for every code-source field, so each is now
`.min(1)` at the contract rather than special-cased in the refinement.

* fix(lambda): reject empty optional strings across the Lambda contracts

An empty `eventSourceArn` alongside bootstrap servers slipped past the
mutual-exclusivity check for the same reason the code-source fields did: the
guard tests truthiness, so a defined-but-empty value reads as absent while the
operation still forwards it.

Rather than patch each field as it surfaces, every optional string field now
rejects an empty value. The tool layer already drops `''` before it reaches a
contract, so an empty value can only arrive from a malformed direct call, and
forwarding it to AWS is never right.

`description` is exempt: AWS documents it as "Minimum length of 0", so an empty
value legitimately clears it. Both behaviours are covered by tests.

* fix(lambda): stop rejecting values AWS documents as valid

A comprehensive validation pass against the API reference found the previous
commit's blanket "no empty optional strings" rule was wrong. Several Lambda
parameters document an empty string as meaningful, and their patterns say so:
KMSKeyArn, SourceKMSKeyArn, and DeadLetterConfig.TargetArn all carry
`(arn:...)|()`, whose trailing alternative matches the empty string, and the
on-success/on-failure destinations document `Minimum length of 0` with a
pattern beginning `$|`. For each, empty is how the setting is cleared.

The rule is now opt-in rather than opt-out: only the five fields feeding a
truthiness-based cross-field check reject an empty value. That removes 47
constraints and leaves the ones that were actually reported.

Also from the same pass:

- Supplying an image URI no longer demands an explicit `packageType`. That
  subBlock is advanced with no default, so requiring it produced a 400 naming
  a control the user cannot see; the operation derives Image from the code
  source instead, and only an explicit Zip alongside an image is rejected.
- `fileSystemConfigs` was the one projection without a null guard, so an
  omitted field vanished from the block output rather than reading null.
- An absent function URL now maps to null instead of an empty string a
  workflow could build a request against.
- GetFunction reports `tagsError`, so a partial tag-read failure is
  distinguishable from a function with no tags, and marks `configuration`
  nullable to match what the operation returns.
- Event source mappings report `selfManagedKafkaBootstrapServers`, which
  could be set but never read back.
- TagResource rejects an empty tag map instead of reporting "0 tags applied".

* test(lambda): prove every projection matches its contract schema

Reading code confirmed the projections and schemas agree, but nothing ran them
against each other. This runs all eight shared mappers against their schemas in
both directions: every declared key is emitted and non-undefined, no undeclared
key is emitted, and the result parses — for an empty AWS response, which is the
common case, and for a fully-populated one.

Verified the suite fails when either defect class is reintroduced: a mapper that
stops emitting a declared key, and a projection that leaks `undefined` where the
schema declares a value.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/lambda.mdx

@@ -115,6 +115,7 @@ Get a function's configuration, code location, tags, and reserved concurrency
 | Parameter | Type | Description |
 | --------- | ---- | ----------- |
 | `configuration` | json | The function's configuration \(ARN, runtime, handler, memory, state, layers, VPC, and logging settings\) |
+| `tagsError` | json | Why the tags could not be read, when a partial tag-read failure occurred |
 | `code` | json | Presigned download URL for the deployment package, or the container image URI |
 | `tags` | json | The function's tags |
 | `reservedConcurrentExecutions` | number | Concurrency reserved for this function, if any |

apps/sim/lib/api/contracts/tools/aws/lambda-create-alias.ts

@@ -16,9 +16,16 @@ const CreateAliasSchema = z.object({
     .string()
     .min(1, 'functionName is required')
     .max(256, 'functionName cannot exceed 256 characters'),
-  aliasName: z.string().min(1, 'aliasName is required'),
+  aliasName: z
+    .string()
+    .min(1, 'aliasName is required')
+    .max(128, 'aliasName cannot exceed 128 characters')
+    .regex(
+      /^(?![0-9]+$)[a-zA-Z0-9-_]+$/,
+      'aliasName may only contain letters, numbers, hyphens, and underscores, and cannot be all digits'
+    ),
   aliasFunctionVersion: z.string().min(1, 'aliasFunctionVersion is required'),
-  description: z.string().optional(),
+  description: z.string().max(256, 'description cannot exceed 256 characters').optional(),
   additionalVersionWeights: z
     .record(
       z.string().regex(/^[0-9]+$/, 'routing keys must be published version numbers'),
@@ -27,6 +34,10 @@ const CreateAliasSchema = z.object({
         .min(0, 'a routing weight cannot be negative')
         .max(1, 'a routing weight cannot exceed 1')
     )
+    .refine(
+      (weights) => Object.keys(weights).length <= 1,
+      'additionalVersionWeights routes to a single second version, so it accepts at most one entry'
+    )
     .optional(),
 })
 

apps/sim/lib/api/contracts/tools/aws/lambda-create-event-source-mapping.ts

@@ -18,7 +18,7 @@ const CreateEventSourceMappingSchema = z
       .string()
       .min(1, 'functionName is required')
       .max(256, 'functionName cannot exceed 256 characters'),
-    eventSourceArn: z.string().optional(),
+    eventSourceArn: z.string().min(1, 'eventSourceArn cannot be empty').optional(),
     enabled: z.boolean().optional(),
     batchSize: z.number().int().min(1).max(10000).optional(),
     maximumBatchingWindowInSeconds: z.number().int().min(0).max(300).optional(),
@@ -54,16 +54,26 @@ const CreateEventSourceMappingSchema = z
     documentDbFullDocument: z.enum(['UpdateLookup', 'Default']).optional(),
     amazonManagedKafkaConsumerGroupId: z.string().optional(),
     selfManagedKafkaConsumerGroupId: z.string().optional(),
-    selfManagedKafkaBootstrapServers: z.array(z.string()).optional(),
+    selfManagedKafkaBootstrapServers: z
+      .array(z.string().min(1, 'a bootstrap server cannot be empty'))
+      .optional(),
   })
   .superRefine((value, ctx) => {
-    if (!value.eventSourceArn && !value.selfManagedKafkaBootstrapServers?.length) {
+    const hasBootstrapServers = Boolean(value.selfManagedKafkaBootstrapServers?.length)
+    if (!value.eventSourceArn && !hasBootstrapServers) {
       ctx.addIssue({
         code: 'custom',
         path: ['eventSourceArn'],
         message:
           'An event source is required: provide eventSourceArn, or selfManagedKafkaBootstrapServers for a self-managed Kafka cluster',
       })
+    } else if (value.eventSourceArn && hasBootstrapServers) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['selfManagedKafkaBootstrapServers'],
+        message:
+          'A mapping has one event source: provide eventSourceArn, or selfManagedKafkaBootstrapServers, not both',
+      })
     }
     if (value.startingPosition === 'AT_TIMESTAMP' && !value.startingPositionTimestamp) {
       ctx.addIssue({

apps/sim/lib/api/contracts/tools/aws/lambda-create-function.ts

@@ -21,12 +21,12 @@ const CreateFunctionSchema = z
     runtime: z.string().optional(),
     handler: z.string().optional(),
     packageType: z.enum(['Zip', 'Image']).optional(),
-    s3Bucket: z.string().optional(),
-    s3Key: z.string().optional(),
-    s3ObjectVersion: z.string().optional(),
-    imageUri: z.string().optional(),
+    s3Bucket: z.string().min(1, 's3Bucket cannot be empty').optional(),
+    s3Key: z.string().min(1, 's3Key cannot be empty').optional(),
+    s3ObjectVersion: z.string().min(1, 's3ObjectVersion cannot be empty').optional(),
+    imageUri: z.string().min(1, 'imageUri cannot be empty').optional(),
     sourceKmsKeyArn: z.string().optional(),
-    description: z.string().optional(),
+    description: z.string().max(256, 'description cannot exceed 256 characters').optional(),
     functionTimeout: z.number().int().min(1).max(900).optional(),
     memorySize: z.number().int().min(128).max(32768).optional(),
     ephemeralStorageSize: z.number().int().min(512).max(10240).optional(),
@@ -48,36 +48,41 @@ const CreateFunctionSchema = z
     logGroup: z.string().optional(),
   })
   .superRefine((value, ctx) => {
+    const hasAnyZipField = Boolean(
+      value.s3Bucket || value.s3Key || value.s3ObjectVersion || value.sourceKmsKeyArn
+    )
     const hasS3 = Boolean(value.s3Bucket && value.s3Key)
-    if (!hasS3 && !value.imageUri) {
+    if (value.imageUri && hasAnyZipField) {
       ctx.addIssue({
         code: 'custom',
-        path: ['s3Bucket'],
+        path: ['imageUri'],
         message:
-          'A code source is required: provide s3Bucket and s3Key for a .zip package, or imageUri for a container image',
+          'Provide either a .zip package (s3Bucket, s3Key, s3ObjectVersion, sourceKmsKeyArn) or imageUri, not both',
       })
       return
     }
-    if (hasS3 && value.imageUri) {
+    if (!value.imageUri && !hasS3) {
       ctx.addIssue({
         code: 'custom',
-        path: ['imageUri'],
-        message: 'Provide either an S3 package or imageUri, not both',
+        path: hasAnyZipField ? ['s3Key'] : ['s3Bucket'],
+        message: hasAnyZipField
+          ? 's3Bucket and s3Key must be provided together for a .zip package'
+          : 'A code source is required: provide s3Bucket and s3Key for a .zip package, or imageUri for a container image',
       })
       return
     }
-    if (value.packageType === 'Image' && hasS3) {
+    if (value.imageUri && value.packageType === 'Zip') {
       ctx.addIssue({
         code: 'custom',
-        path: ['imageUri'],
-        message: 'packageType Image requires imageUri, not an S3 package',
+        path: ['packageType'],
+        message: 'packageType Zip requires an S3 package, not imageUri',
       })
     }
-    if (value.packageType === 'Zip' && value.imageUri) {
+    if (hasS3 && value.packageType === 'Image') {
       ctx.addIssue({
         code: 'custom',
-        path: ['s3Bucket'],
-        message: 'packageType Zip requires an S3 package, not imageUri',
+        path: ['imageUri'],
+        message: 'packageType Image requires imageUri, not an S3 package',
       })
     }
     if (hasS3) {
@@ -96,15 +101,26 @@ const CreateFunctionSchema = z
         })
       }
     }
-    const hasSubnets = value.vpcSubnetIds !== undefined
-    const hasSecurityGroups = value.vpcSecurityGroupIds !== undefined
-    if (hasSubnets !== hasSecurityGroups) {
+    const subnetIds = value.vpcSubnetIds
+    const securityGroupIds = value.vpcSecurityGroupIds
+    if ((subnetIds === undefined) !== (securityGroupIds === undefined)) {
       ctx.addIssue({
         code: 'custom',
-        path: [hasSubnets ? 'vpcSecurityGroupIds' : 'vpcSubnetIds'],
+        path: [subnetIds === undefined ? 'vpcSubnetIds' : 'vpcSecurityGroupIds'],
         message:
           'vpcSubnetIds and vpcSecurityGroupIds must be supplied together: send both lists to attach a VPC, or both empty to detach',
       })
+    } else if (
+      subnetIds !== undefined &&
+      securityGroupIds !== undefined &&
+      (subnetIds.length === 0) !== (securityGroupIds.length === 0)
+    ) {
+      ctx.addIssue({
+        code: 'custom',
+        path: [subnetIds.length === 0 ? 'vpcSubnetIds' : 'vpcSecurityGroupIds'],
+        message:
+          'vpcSubnetIds and vpcSecurityGroupIds must both be empty to detach, or both be populated to attach',
+      })
     }
   })
 

apps/sim/lib/api/contracts/tools/aws/lambda-delete-alias.ts

@@ -16,7 +16,14 @@ const DeleteAliasSchema = z.object({
     .string()
     .min(1, 'functionName is required')
     .max(256, 'functionName cannot exceed 256 characters'),
-  aliasName: z.string().min(1, 'aliasName is required'),
+  aliasName: z
+    .string()
+    .min(1, 'aliasName is required')
+    .max(128, 'aliasName cannot exceed 128 characters')
+    .regex(
+      /^(?![0-9]+$)[a-zA-Z0-9-_]+$/,
+      'aliasName may only contain letters, numbers, hyphens, and underscores, and cannot be all digits'
+    ),
 })
 
 const DeleteAliasResponseSchema = lambdaMessageResponseSchema

apps/sim/lib/api/contracts/tools/aws/lambda-get-alias.ts

@@ -16,7 +16,14 @@ const GetAliasSchema = z.object({
     .string()
     .min(1, 'functionName is required')
     .max(256, 'functionName cannot exceed 256 characters'),
-  aliasName: z.string().min(1, 'aliasName is required'),
+  aliasName: z
+    .string()
+    .min(1, 'aliasName is required')
+    .max(128, 'aliasName cannot exceed 128 characters')
+    .regex(
+      /^(?![0-9]+$)[a-zA-Z0-9-_]+$/,
+      'aliasName may only contain letters, numbers, hyphens, and underscores, and cannot be all digits'
+    ),
 })
 
 const GetAliasResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/lambda-get-function.ts

@@ -27,6 +27,9 @@ const GetFunctionResponseSchema = z.object({
   success: z.literal(true),
   output: z.object({
     configuration: lambdaFunctionConfigurationSchema.nullable(),
+    tagsError: z
+      .object({ errorCode: z.string().nullable(), message: z.string().nullable() })
+      .nullable(),
     code: z
       .object({
         repositoryType: z.string().nullable(),

apps/sim/lib/api/contracts/tools/aws/lambda-get-layer-version.ts

@@ -12,7 +12,14 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 
 const GetLayerVersionSchema = z.object({
   ...lambdaConnectionFields,
-  layerName: z.string().min(1, 'layerName is required'),
+  layerName: z
+    .string()
+    .min(1, 'layerName is required')
+    .max(140, 'layerName cannot exceed 140 characters')
+    .regex(
+      /^(arn:[a-zA-Z0-9-]+:lambda:[a-zA-Z0-9-]+:\d{12}:layer:[a-zA-Z0-9-_]+)$|^[a-zA-Z0-9-_]+$/,
+      'layerName must be a layer name or a layer ARN'
+    ),
   versionNumber: z.number().int().min(1, 'versionNumber must be at least 1'),
 })
 

apps/sim/lib/api/contracts/tools/aws/lambda-list-event-source-mappings.ts

@@ -14,8 +14,12 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 const ListEventSourceMappingsSchema = z.object({
   ...lambdaConnectionFields,
   ...lambdaPaginationFields,
-  functionName: z.string().optional(),
-  eventSourceArn: z.string().optional(),
+  functionName: z
+    .string()
+    .min(1, 'functionName cannot be empty')
+    .max(256, 'functionName cannot exceed 256 characters')
+    .optional(),
+  eventSourceArn: z.string().min(1, 'eventSourceArn cannot be empty').optional(),
 })
 
 const ListEventSourceMappingsResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/lambda-list-layer-versions.ts

@@ -14,7 +14,14 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 const ListLayerVersionsSchema = z.object({
   ...lambdaConnectionFields,
   ...lambdaSmallPaginationFields,
-  layerName: z.string().min(1, 'layerName is required'),
+  layerName: z
+    .string()
+    .min(1, 'layerName is required')
+    .max(140, 'layerName cannot exceed 140 characters')
+    .regex(
+      /^(arn:[a-zA-Z0-9-]+:lambda:[a-zA-Z0-9-]+:\d{12}:layer:[a-zA-Z0-9-_]+)$|^[a-zA-Z0-9-_]+$/,
+      'layerName must be a layer name or a layer ARN'
+    ),
   compatibleRuntime: z.string().optional(),
   compatibleArchitecture: z.enum(['x86_64', 'arm64']).optional(),
 })